The EU Cybersecurity and AI Action Plan, published in July 2026, is the European Commission’s first coordinated policy response to the convergence of artificial intelligence and cyber threats. It does not replace NIS-2, DORA or the AI Act; instead it raises the floor of what supervisory authorities will treat as adequate implementation of those frameworks, specifically by requiring that AI-augmented attack vectors are addressed as named, documented and tested risks rather than background assumptions.
What the Action Plan Requires of Sovereign Infrastructure Operators
The Action Plan identifies three AI-augmented attack categories that regulated organisations must explicitly address in their risk management frameworks: AI-generated spearphishing, AI-driven automated vulnerability exploitation, and deepfake-enabled social engineering targeting staff with privileged access or payment authority.
For each category, the Action Plan calls on ENISA and national competent authorities to update supervisory guidance under NIS-2 Directive (EU) 2022/2555 Article 21, which requires essential and important entities to implement technical and organisational measures proportionate to the risk. The practical consequence is that a risk assessment that does not document AI-augmented scenarios will increasingly be viewed as incomplete during competent authority audits. Sovereign infrastructure operators running on-premises environments, including those hosting sensitive government, financial or health data, face this expectation without the option of pointing to a hyperscaler’s shared responsibility model.
The Action Plan also establishes a coordinated EU-level incident response mechanism for AI-related cyber incidents, linking national CERTs, ENISA’s situational awareness function and the NIS Cooperation Group. Sovereign operators must map their internal escalation procedures to this external framework, because failure to notify through the correct channel within the NIS-2 Article 23 timeframe (24 hours for early warning, 72 hours for incident notification) can trigger administrative fines independent of whether any data was actually exfiltrated.
Integrating the Action Plan with NIS-2 Article 21 and DORA Chapter II
The intersection of the Action Plan with existing regulation is additive, not substitutive. Organisations subject to both NIS-2 and DORA Regulation (EU) 2022/2554 Chapter II must demonstrate coherence across their ICT risk management frameworks, and the Action Plan now adds an AI-threat dimension to both.
Under DORA Chapter II, financial entities must maintain a comprehensive ICT risk management framework that includes identification, protection, detection, response and recovery. The Action Plan’s coordinated response framework should be embedded at the detection and response layers. Concretely, this means:
- Detection playbooks must be updated to include behavioural indicators specific to AI-generated content, such as linguistic consistency anomalies in email bodies and voice frequency patterns in deepfake audio used for authorisation calls.
- Response runbooks must reference the EU coordinated response channel, not only the organisation’s lead supervisory authority, when an incident has cross-border characteristics.
- ICT risk assessments submitted to supervisors under DORA must document AI-augmented threat scenarios with supporting evidence, such as red-team exercise results or third-party penetration test findings.
The AI Act Article 9 risk management system requirement applies to any AI system classified as high-risk. Financial institutions using AI-based credit scoring, fraud detection or patient triage systems in healthcare must maintain a continuous risk management process for those systems. The Action Plan signals that supervisors will scrutinise whether this risk management process is integrated with the broader ICT risk framework or runs in isolation.
The ECB Asymmetry Finding and What It Changes
The ECB Operational Resilience Assessment of June 2026 introduced a finding that has direct implications for every financial entity subject to DORA. The ECB concluded that a structural asymmetry exists between attackers, who can use AI to automate, scale and personalise attacks at near-zero marginal cost, and defenders, who remain constrained by legacy detection architectures and fragmented tooling.
“The financial sector faces an asymmetry where attackers can leverage AI to automate and amplify attacks while defenders remain constrained by legacy processes and fragmented tooling.” (European Central Bank, Operational Resilience Assessment, June 2026)
The cost of failing to close this asymmetry is not abstract. The average cost of a data breach in the financial sector reached USD 6.08 million in 2024, the highest of any regulated industry tracked in that period (IBM Cost of a Data Breach Report, 2024). For sovereign infrastructure protecting sensitive financial or health data, the minimum viable security posture must now include continuous adversarial simulation, not periodic penetration testing on a yearly cycle.
| Security dimension | Pre-Action Plan baseline | Post-Action Plan minimum |
|---|---|---|
| Phishing detection | Signature and reputation-based email filtering | Behavioural and linguistic anomaly scoring, updated for AI-generated content |
| Vulnerability management | Monthly patching cycle with CVSS prioritisation | Near-real-time exploit intelligence with AI-driven exploitation probability scoring |
| Incident response testing | Annual tabletop exercises | Continuous adversarial simulation including deepfake and AI-generated scenario variants |
| Threat intelligence sourcing | Commercial feeds, including US-hosted SaaS platforms | ENISA and national CERT feeds, supplemented by sovereign in-house detection engineering |
Open-Weight AI Models and the New EU Evaluation Capacity
The Action Plan announces a new EU-level evaluation capacity for AI models, focused on general-purpose and high-risk models. For organisations running locally hosted open-weight models such as Mistral or Llama, this changes the threat model in a specific way. The evaluation capacity will generate public advisories on newly identified attack surfaces in open-weight model architectures, including prompt injection vulnerabilities, data poisoning vectors and inference-time manipulation techniques.
Running a model locally preserves jurisdictional control over the data processed by that model. No inference request leaves the sovereign perimeter, and the model’s weights are not subject to CLOUD Act reach because they reside on European hardware. However, the EU evaluation capacity means that newly identified vulnerabilities in those model weights will become public knowledge. Organisations must therefore establish a model update and patching process comparable to the one they apply to operating systems, including tracking ENISA advisories and applying updates before vulnerabilities are actively exploited.
Sovereign Logging, SIEM and Detection Without US-Controlled Feeds
Any SIEM or threat-intelligence feed hosted under US jurisdiction is potentially subject to compelled disclosure under the CLOUD Act or FISA Section 702. For sovereign infrastructure operators, routing detection telemetry through such services creates jurisdictional exposure that undermines the entire value of sovereign hosting. The Action Plan reinforces the case for building detection capability entirely within the European perimeter.
Practically, this means building detection engineering capacity around three pillars. First, ingest from European sources: ENISA’s threat-intelligence sharing platform, national CERT advisories and EU-ISAC feeds for the relevant sector. Second, maintain in-house detection rules for AI-generated attack patterns, specifically rules that score for linguistic uniformity in mass spearphishing campaigns, anomalous API call sequences indicative of automated vulnerability scanning, and voice biometric inconsistencies in deepfake audio. Third, store all logs exclusively on infrastructure within the sovereign perimeter, because log data is primary evidence in both incident response and regulatory investigations, and its location determines which legal framework governs access.
“Artificial intelligence is increasingly used by threat actors to enhance the scale, speed and sophistication of cyberattacks, and defenders must match that capability with equally advanced detection and response.” (ENISA, Threat Landscape 2024)
Board Accountability Under NIS-2 Article 20 and DORA After the Action Plan
NIS-2 Article 20 places personal liability on management body members for approving and overseeing cybersecurity risk-management measures. The Action Plan does not create new liability categories, but it does make ignorance of AI-augmented threat scenarios significantly harder to sustain as a defence. When ENISA and national competent authorities publish updated guidance reflecting Action Plan priorities, management bodies that have not updated their approved risk frameworks accordingly are in a documentable gap position.
Boards should take three concrete steps. First, commission a gap analysis that maps current NIS-2 Article 21 and DORA Chapter II risk documentation against the AI-augmented threat categories named in the Action Plan, and record the outcome in board minutes. Second, approve updated escalation procedures that specify when an AI-augmented incident triggers mandatory notification under NIS-2 Article 23, and who within the management body is personally accountable for that decision. Third, require at least annual reporting from the CISO or DPO on red-team exercise results against AI-generated attack scenarios, with those results treated as material risk information that the board has received and reviewed.
The intersection of AI Act Article 9 with board accountability is particularly sharp for healthcare and financial organisations that deploy high-risk AI systems: board members are expected to understand and approve the risk management system for those AI tools, not delegate it entirely to technical staff. A management body that approved a high-risk AI system without a documented Article 9 risk management process faces compounding exposure if that system is later implicated in a security incident.
FAQ
Does the EU Cybersecurity and AI Action Plan create new binding legal obligations on top of NIS-2 and DORA?
The Action Plan itself is a policy coordination instrument, not a directly binding regulation. However, it directs ENISA and national competent authorities to update supervisory guidance and audit criteria under NIS-2 and DORA. Organisations that do not address AI-augmented threat scenarios risk being found non-compliant with existing Article 21 measures during supervisory audits, even though the Action Plan does not itself carry penalty provisions.
What must a board formally approve under NIS-2 Article 20 to account for AI-augmented threats?
Boards must approve and document policies that explicitly address AI-generated spearphishing, automated vulnerability exploitation and deepfake social engineering. These policies must be tested, and the test results must be presented to the board as material risk information. Personal liability under Article 20 attaches to board members who are shown to have received risk information and failed to act on it.
Can a sovereign infrastructure operator use locally hosted open-weight models without EU model evaluation affecting their threat model?
Local hosting preserves jurisdictional control because no data leaves the perimeter. However, the EU evaluation capacity will surface vulnerabilities in open-weight model architectures as public advisories. Operators must treat these advisories like operating system security patches, applying updates before vulnerabilities are exploited and documenting their evaluation process under AI Act Article 9 where applicable.
How can a sovereign SIEM detect AI-generated spearphishing without US-hosted threat-intelligence feeds?
Sovereign detection relies on ENISA’s threat-intelligence sharing platform and national CERT advisories, combined with in-house behavioural detection rules. Effective rules for AI-generated phishing score for linguistic uniformity across large volumes of messages, anomalous sender-recipient relationship graphs, and timing patterns inconsistent with human composition. Log infrastructure must remain entirely within the sovereign perimeter to avoid CLOUD Act exposure.
Does the ECB asymmetry finding apply to smaller financial institutions, or only to systemically important banks?
The asymmetry finding applies across the sector. AI tooling scales cheaply, so attackers target institutions of all sizes simultaneously. DORA’s proportionality principle allows smaller entities to implement a scaled ICT risk management framework, but it does not exempt them from the framework itself. All DORA-obligated entities must document AI-augmented threat scenarios and demonstrate adequate detection and response capability, proportionate to their risk profile.
Hoe Qsentinel dit oplost
Qsentinel is the managed Nextcloud Enterprise workspace, enhanced by Qsentinel with post-quantum encryption and sovereign private AI, hosted in Switzerland or on-premise, out of reach of the CLOUD Act.